Remove SID with ICACLS

Question

I am trying to remove an obsolete SID (the account was apparently deleted).

I've tried to run the following on the server (win2003) and a client (win7):

icacls c:\path /remove *S-1-5-21-1883347182-1220252494-433279356-1095 /T

But I always get the output

Successfully processed 0 files; Failed processing 0 files

without it doing anything. How can I get it to work?

Update:

I've used AccessEnum to get the SID because icacls only says "No mapping between account names and security IDs was done." but doesn't show the sid.

The output from AccessEnum is:

"Path"  "Read"  "Write" "Deny"  
"c:\path"   "Administrators, S-1-5-21-1883347182-1220252494-433279356-1095, ..."    "Administrators, S-1-5-21-1883347182-1220252494-433279356-1095, ..."    ""  

Answer 1

My suggestion to another similar question

"perhaps you're looking for SUBINACL. Download it here

subinacl.exe /help /cleandeletedsidsfrom provides the following:

/cleandeletedsidsfrom=domain[=dacl|sacl|owner|primarygroup|all]

delete all ACEs containing deleted (no valid) Sids from DomainName You can specify which part of the security descriptor will be scanned (default=all) If the owner is deleted, new owner will be the Administrators group. If the primary group is deleted, new primary group will be the Users group. Appears you can use this with /file or /share or /subdirectories as needed

Answer 2

You can easily do that with SetACL:

SetACL -on C:\Path -ot file -actn trustee -trst 
       "n1:S-1-5-21-1883347182-1220252494-433279356-1095;s1:y;ta:remtrst;w:dacl"

Answer 3

Why not just use the GUI? Bring up the folder properties and remove the unwanted SID from the security settings. That's always worked for me.